namespace ZB.MOM.WW.Secrets.Abstractions;

/// <summary>
/// Resolves the current principal (the ZB.MOM.WW.Auth identity) for audit attribution when a
/// secret is resolved. A consumer wires this to whatever surfaces the ambient caller — an HTTP
/// context accessor, an actor context, a CLI identity, etc. When <see cref="CurrentActor"/> is
/// <c>null</c> (or no accessor is registered), the fallback actor string is consumer-defined so an
/// action is still attributed rather than left blank — e.g. <c>"system"</c> for background/keyless
/// resolution, or <c>"unknown"</c> for an unauthenticated UI action (the value the UI's
/// <c>SecretActorResolver</c> uses).
/// </summary>
public interface ISecretActorAccessor
{
    /// <summary>
    /// The current principal to record as the audit <c>Actor</c>, or <c>null</c> when no
    /// principal is available (the resolver then substitutes its consumer-defined fallback actor).
    /// </summary>
    string? CurrentActor { get; }
}
